diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index ee038c41..fc4ec447 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -56,6 +56,22 @@ jobs:
       - name: lint
         run: sh scripts/check-attribution-trailers.sh
 
+  shellcheck:
+    name: shellcheck
+    runs-on: [hive-ci]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v3
+      - name: lint
+        # By shebang, not a `*.sh` glob — scripts/pre-push has no suffix.
+        run: |
+          files=$(grep -lE '^#!.*/(env[[:space:]]+)?(ba)?sh([[:space:]]|$)' scripts/* 2>/dev/null)
+          if [ -z "$files" ]; then
+            echo "no shell files discovered under scripts/ — check the shebang pattern" >&2
+            exit 1
+          fi
+          echo "$files" | xargs nix develop -c shellcheck -S warning
+
   prose-lint:
     name: prose lint (vale)
     runs-on: [hive-ci]